On Thu, Jan 20, 2022 at 10:27 PM Pavel Skripkin <paskripkin@xxxxxxxxx> wrote: > > Hi Dongliang, > > On 1/20/22 16:05, Dongliang Mu wrote: > > From: Dongliang Mu <mudongliangabcd@xxxxxxxxx> > > > > The error handling code of peak_usb_create_dev forgets to reset the > > next_siblings of previous entry. > > > > Fix this by nullifying the (dev->prev_siblings)->next_siblings in the > > error handling code. > > > > Signed-off-by: Dongliang Mu <mudongliangabcd@xxxxxxxxx> > > --- > > drivers/net/can/usb/peak_usb/pcan_usb_core.c | 3 +++ > > 1 file changed, 3 insertions(+) > > > > diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c > > index b850ff8fe4bd..f858810221b6 100644 > > --- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c > > +++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c > > @@ -894,6 +894,9 @@ static int peak_usb_create_dev(const struct peak_usb_adapter *peak_usb_adapter, > > dev->adapter->dev_free(dev); > > > > lbl_unregister_candev: > > + /* remove the dangling pointer in next_siblings */ > > + if (dev->prev_siblings) > > + (dev->prev_siblings)->next_siblings = NULL; > > unregister_candev(netdev); > > > > lbl_restore_intf_data: > > > Is this pointer used somewhere? I see, that couple of > struct peak_usb_adapter::dev_free() functions use it, but > peak_usb_disconnect() sets dev->next_siblings to NULL before calling > ->dev_free(). > > Do you have a calltrace or oops log? Hi Pavel, I have no calltrace or log since this dangling pointer may not be dereferenced in the following code. But I am not sure. So the commit title of this patch is "remove a dangling pointer in peak_usb_create_dev". > > > > > With regards, > Pavel Skripkin
